Applying Systems Thinking to Engineering and Design - MDPI

systems Article

Applying Systems Thinking to Engineering and Design Jamie P. Monat *

and Thomas F. Gannon

Systems Engineering Program, Worcester Polytechnic Institute, Worcester, MA 01609, USA; [email protected] * Correspondence: [email protected] Received: 13 July 2018; Accepted: 14 September 2018; Published: 19 September 2018







Abstract: The application of Systems Thinking principles to Systems Engineering is synergistic, resulting in superior systems, products, and designs. However, there is little practical information available in the literature that describes how this can be done. In this paper, we analyze 12 major Systems Engineering failures involving bridges, aircraft, submarines, water supplies, automobiles, skyscrapers, and corporations and recommend Systems Thinking principles, tools, and procedures that should be applied during the first few steps of the System Engineering design process to avoid such catastrophic Systems Engineering failures in the future. Keywords: systems thinking; systems engineering; design

1. Introduction 1.1. Systems Thinking and Systems Engineering Systems Thinking and Systems Engineering are not the same. Systems Thinking has been characterized as a perspective, a language, and a set of tools [1]. It is a holistic perspective that acknowledges that the relationships among system components and between the components and the environment are as important (in terms of system behavior) as the components themselves. It is a language of feedback loops, emergent properties, complexity, hierarchies, self-organization, dynamics, and unintended consequences. Systems Thinking tools include the Iceberg model which posits that, in systems, repeated events and patterns (which are observable) are caused by structure (stocks, flows, and feedback loops), which are, in turn, caused by underlying forces such as mental models, gravity, and electromagnetism. Additional Systems Thinking tools include causal loop diagrams, behavior-over-time plots, stock-and-flow diagrams, systemic root cause analysis, dynamic modeling tools, and archetypes. A more comprehensive explanation of Systems Thinking is provided by Monat and Gannon [1]. Systems Engineering is an interdisciplinary approach and means to enable the development of successful systems. It focuses on defining customer needs and required functionality early in the development cycle, documenting requirements, and then proceeding with design, synthesis, validation, deployment, maintenance, evolution and eventual disposal of a system. Systems Engineering integrates a wide range of engineering disciplines into a team effort, which uses a structured development process that proceeds from an initial concept to production and operation of a system. It takes into account both the business and technical needs of all customers with the goal of providing a quality product that meets the needs of all users. A more comprehensive description of Systems Engineering and the structured processes used by Systems Engineers to develop systems is provided by Kossiakoff et al. [2].

Systems 2018, 6, 34; doi:10.3390/systems6030034

www.mdpi.com/journal/systems

Systems 2018, 6, 34

2 of 20

Table 1 shows the Systems Thinking concepts that are applicable to Systems Engineering and Design. Table 1. Systems Thinking concepts applicable to Systems Engineering and Design. Systems Thinking Principle

Applicable to Systems Engineering and Design?

Holistic Perspective/Proper Definition of System Boundaries Focus on Relationships Sensitivity to Feedback Awareness that Events and Patterns are caused by Underlying Structures and Forces Dynamic Modeling Systemic Root Cause Analysis Sensitivity to Emergent Properties Sensitivity to Unintended Consequences

Yes Yes Yes To a Degree Sometimes Yes, when troubleshooting Yes Yes

Systems Thinking and Systems Engineering are related and synergistic, and the application of Systems Thinking Principles to Systems Engineering can result in superior systems. However, there seems to be a dearth of practical information describing how this can be done. Lawson [3] discusses the natural coupling of thinking and engineering systemic structures, and gets into the specifics of applying Systems Thinking principles and tools (such as a System Coupling Diagram) to Systems Engineering. He couples thinking with acting via OODA (Observe-Orient-Decide-Act) and PDCA (Plan-Do-Check-Act) loops [4,5]. The PDCA loop seems especially relevant to systems engineering. Lawson provides a good example of the application of Systems Thinking principles to the development of automatic train control in Sweden in the 1970s. Kasser and Mackley [6] do a very nice job describing various Systems Thinking Perspectives (Operational, Functional, Big picture, Structural, Generic, Continuum, Temporal, Quantitative, Scientific) and applying them (by way of example) to the Royal Air Force (RAF) Battle of Britain Air Defence System (RAFBADS) by asking “Who, what, why, where, when, and how?” for each perspective. The Systems Thinking perspectives represent a good tool; however, more tools and specifics would be useful in inculcating Systems Thinking into Engineering and Design. Godfrey [7] suggests that Systems Thinking is essential for Systems Engineers and that Systems Thinking provides a key underpinning for Systems Engineering. Godfrey’s work supports Kasser’s “Who, what, why, where, when, and how?” approach but focuses on explaining Systems Thinking as opposed to its application to and integration with Systems Engineering. Pyster et al. [8] obliquely relate Systems Thinking to Systems Engineering via the application of patterns and archetypes. The INCOSE Systems Engineering Handbook [9] describes Systems Thinking and lists several Systems Thinking principles that Systems Engineers are likely to encounter. It does not, however, prescribe a methodology or integrate Systems Thinking tools with Systems Engineering. Burge [10] extols the virtues of Systems Thinking in engineering design and points out that it may be used in several different ways: to gain understanding of a complex situation, to gain sufficient understanding to make predictions of future system behavior, to solve a problem, or to create a new or modified system; however, he does not explain how this is to be done. Frank [11] explores the cognitive competencies (several of which involve Systems Thinking) of successful Systems Engineers, but he does not discuss how Systems Thinking principles or tools should be applied to Systems Engineering. There are also instructive examples of Systems Engineering failures due to inattention to Systems Thinking principles. 1.2. Systems Engineering Failures Due to Lack of Systems Thinking There have been many Systems Engineering and design failures due to a lack of applying Systems Thinking. In this section, we describe a few of the more infamous cases.

Systems 2018, 6, 34 x FOR PEER REVIEW

of 20 20 33 of

Galloping Gertie. The infamous Tacoma Narrows Bridge linked Tacoma, Washington to the Galloping Gertie. The infamousThe Tacoma Narrows Bridge linked Tacoma, Washington toknown the Kitsap Kitsap Peninsula from 1938–1940. bridge spanned the Tacoma Narrows, which was for Peninsula from 1938–1940. The bridge spanned the Tacoma Narrows, which was known for high high winds. Those high winds caused both an up-and-down roller-coaster like oscillation and winds. Those high winds both an up-and-down aeroelastic aeroelastic torsional flutter:caused an oscillatory twisting of theroller-coaster bridge deck like [12].oscillation This latterand phenomenon torsional flutter: an oscillatory twisting of the bridge deck [12]. This latter phenomenon comprised comprised a destructive reinforcing feedback mechanism when winds blew horizontally across thea destructive mechanismvibration when winds blewbyhorizontally across bridge deck bridge deckreinforcing (similar to feedback the sound-inducing created blowing across a the taught blade of (similar to thethe sound-inducing vibration created by blowing across a taught blade of grass). the grass). When windward edge of the deck flexed slightly up or down (in this case due to aWhen support windward edgemore of the flexed slightly up or down (insurface this casearea duewas to a exposed support cable cable failure), ofdeck the deck’s horizontally-projected to thefailure), wind, more of the deck’s horizontally-projected surface areaeven was exposed to twist the wind, yielding higher wind yielding higher wind forces, which twisted the deck more. The increased until the deck’s forces, which twisted the deck even more. The twist increased until the deck’s torsional restoring force torsional restoring force returned it to horizontal and beyond, and the process repeated, yielding a returned it to horizontal and beyond, and the process repeated, yielding a sinusoidal torsional oscillation sinusoidal torsional oscillation (several good videos of this phenomenon and the subsequent collapse (several of this phenomenon the subsequent collapse may be found online.) Vortex may be good foundvideos online.) Vortex shedding and downwind of the deck exacerbated the oscillations. The shedding downwind of the deck exacerbated the oscillations. The torsional oscillations were usually torsional oscillations were usually adequately damped by the stiffness of the bridge deck, but with adequately damped by the stiffness of the bridge deck, buta with the unfortunate combination of on high the unfortunate combination of high wind speed and snapped support cable (occurring 7 wind speed1940), and a the snapped support cableto (occurring onAt 7 November the damping declined to November damping declined near zero. this point, 1940), the torsional oscillations grew near larger, zero. Atuntil this the point, the torsional ever bridge collapsedoscillations (Figure 1).grew ever larger, until the bridge collapsed (Figure 1).

Figure Figure 1. The The Tacoma Tacoma Narrows Bridge collapse.

Specific System Thinking Thinking Oversight: Oversight: Failure to bound the system properly and to adequately evaluate system component interactions with the environment under all conditions, especially with The original original bridge bridge design design had had called called for for 25-foot 25-foot high high trusses trusses under under the the deck, deck, respect to feedback. The which would have stiffened the deck sufficiently to prevent prevent the the collapse. collapse. However, However, to to save save money, money, that design was supplanted with a new design design that that replaced replaced the the trusses trusses with with 8-foot 8-foot high high steel steel plates, plates, The bridge bridge designers designers might be saving $3 million, but significantly reducing torsional torsional resistance. resistance. The experience with with wind-induced wind-induced bridge bridge failure failure and and torsional torsionalflutter. flutter. excused had there been no prior experience However, these been observed in the latelate 19th19th century [13];[13]; in this they were However, thesephenomena phenomenahad hadboth both been observed in the century in case, this case, they simply forgotten or ignored [14]. [14]. were simply forgotten or ignored Millennium Bridge, Bridge,London. London.The TheMillennium Millennium Bridge (Figure 2) aispedestrian a pedestrian bridge crossing Millennium Bridge (Figure 2) is bridge crossing the the Thames River in London. It was 1998–2000 and opened to pedestrian in 2000. Thames River in London. It was builtbuilt fromfrom 1998–2000 and opened to pedestrian traffictraffic in 2000. The The bridge design (the result of a competition) was novel, a shallow and the supporting bridge design (the result of a competition) was novel, with awith shallow profileprofile and the supporting cables cables below the deck [15]. Shortly after opening, pedestrians noticed a peculiar lateral swaying below the deck [15]. Shortly after opening, pedestrians noticed a peculiar lateral swaying motion that motion that them to adjust naturally adjust their in synchronization with the [16]. sway This [16]. caused themcaused to naturally their stride in stride synchronization with the sway This synchronization amplified theas sway as the was bridge wasatdriven at its natural lateral resonance synchronization amplified the sway the bridge driven its natural lateral resonance frequency frequency in a reinforcing (the sway caused pedestrians to march step with the sway; in a reinforcing feedback feedback loop (theloop sway caused pedestrians to march in stepinwith the sway; the the marching in step amplified sway.) Vertical resonance caused wind or by soldiers marching marching in step amplified the the sway.) Vertical resonance caused by by wind or by soldiers marching in in step was well-known to bridge designers, but lateral resonance had not been anticipated in this step was well-known to bridge designers, but lateral resonance had not been anticipated in this new, new, modern design Eighty-nine vertical horizontal dampers wereinstalled installedon onthe thebridge bridge to modern design [17].[17]. Eighty-nine vertical andand horizontal dampers were correct this problem, at a cost of ~$7 million.

Systems 2018, 6, 34

4 of 20

Systems 2018, 6, x FOR PEER REVIEW

4 of 20

Figure 2. London’s Millennium Millennium footbridge. Figure 2. London’s footbridge.

Specific System Thinking Oversight:

Failure to adequately evaluate system component

Specific System Oversight: to toadequately evaluate system component interactions underThinking all use conditions, especiallyFailure with respect feedback. Despite thorough engineering interactions under allconstruction use conditions, to feedback. analysis prior to (includingespecially modeling andwith wind respect tunnel testing to assess bothDespite lateral andthorough torsional impacts of vertical pedestrian excitation), themodeling analyses did notwind consider synchronous lateral engineering analysis prior to construction (including and tunnel testing to assess both excitation. There was reference to this phenomenon in the literature [18,19], but building codes did lateral and torsional impacts of vertical pedestrian excitation), the analyses did not consider not mention it. Subsequent to the bridge’s construction, BD 37/01 (the British Standard on bridge live synchronous lateral excitation. There was reference to this phenomenon in the literature [18,19], but loading) was revised to include a section on synchronous lateral excitation. building codes did notL-188 mention it. Subsequent bridge’s construction, BD 37/01 (the British The Lockheed Electra Turboprop Airplane. to Thethe L-188 Electra was a 4-engine turboprop airplane Standarddeveloped on bridge live loading) revised include a two section on synchronous lateral excitation. by Lockheed in the was late 1950s. The to plane suffered fatal crashes in 1959 (Braniff 542) and (Northwest 710), killing Turboprop 97 passengersAirplane. and crew. In each of these crashes,was excessive wing flutter The1960 Lockheed L-188 Electra The L-188 Electra a 4-engine turboprop and vibration led to the wings shearing off the fuselage. Analysis and wind tunnel tests revealed a fatal airplane developed by Lockheed in the late 1950s. The plane suffered two fatal crashes in 1959 (Braniff mechanical feedback loop involving the plane’s engine mounts. It was determined that the 542) andreinforcing 1960 (Northwest 710), killing 97 passengers and crew. In each of these crashes, excessive engine mounts permitted small oscillations of the engine on the wing. These engine oscillations caused wing flutter andtovibration ledintoturn, the caused wingsthe shearing the fuselage. and wind tunnel tests the wing flutter, which, engine tooff oscillate more. The Analysis increased engine oscillation revealedincreased a fatal reinforcing mechanical feedback loop the plane’s engine the wing flutter. This reinforcing feedback loopinvolving caused the wings to vibrate at theirmounts. natural It was resonant eventually breaking away from the fuselage. In thisof situation, mechanical feedback determined thatfrequency, the engine mounts permitted small oscillations the engine on the wing. These was not considered either the to design stage or the engineering test stage. It is interesting to note engine oscillations causedinthe wing flutter, which, in turn, caused the engine to oscillate more. The that, after the crashes, the engine oscillations were subsequently reproduced in wind-tunnel testing of increased engine oscillation increased the wing flutter. This reinforcing feedback loop caused the scale models. wings to vibrate at their natural resonant frequency, eventually breaking away from the fuselage. In Specific System Thinking Oversight: Failure to properly evaluate system component interactions this situation, mechanical feedback was not considered in either the design stage or the engineering under all use conditions, especially with respect to feedback. Water of Ayolé.toThe Water of Ayolé engineering/technical issues are test stage. ItThe is interesting note that, after demonstrates the crashes,that thefew engine oscillations were subsequently exclusively technical; most involve support infrastructures, people, the environment, economics, reproduced in wind-tunnel testing of scale models. and other factors. Ayolé is a small rural village in the West African country of Togo. In the 1970s–80s, Specific System Thinking Oversight: Failure to properly evaluate system component the water source for the village was the Amou River, which happened to be infested with the guinea interactions under all use conditions, especially with respect to feedback. worm Dracunculus medinensis, a parasite that infects a human host and causes excruciating pain. TheTo Water of Ayolé. The Water ofand Ayolé demonstrates that fewdug engineering/technical issues are address this issue, government international aid organizations and installed wells in the village, which worked well for several years. However, as the people, wells broke (due to normal wear exclusively technical; most involve support infrastructures, thedown environment, economics, and and tear), no spare parts were available, no technical expertise was available to fix or maintain the other factors. Ayolé is a small rural village in the West African country of Togo. In the 1970s–80s, the pumps, and no money was available to pay for repairs. After three years, the people of Ayolé were water source for the village was the Amou River, which happened to be infested with the guinea back to using the contaminated water from the river. The government engineers had interpreted this worm Dracunculus medinensis, a parasite that infects a human host and causes excruciating pain. To as a purely technical/engineering problem, when in fact it was much broader. To their credit, the local address Togolese this issue, government andSystems international organizations dug and installed wells in the extension agents applied Thinking aid to address the larger systemic issues. They trained some ofworked the villagers in well maintenance andHowever, repair; they established a repair parts supply chain the village, which well for several years. as the wells broke down (due tovia normal wear local Togo hardware store; and the women of the village structured an agricultural product production and tear), no spare parts were available, no technical expertise was available to fix or maintain the and sales system to generate money to pay for the parts. What was thought to be a simple engineering pumps, and no money was available to pay for repairs. After three years, the people of Ayolé were problem turned out to be an engineering/socio-economic/logistics/psychological problem. back to using the contaminated water from the river. The government engineers had interpreted this as a purely technical/engineering problem, when in fact it was much broader. To their credit, the local Togolese extension agents applied Systems Thinking to address the larger systemic issues. They trained some of the villagers in well maintenance and repair; they established a repair parts supply chain via the local Togo hardware store; and the women of the village structured an agricultural product production and sales system to generate money to pay for the parts. What was thought to be

Systems 2018, 6, 34

5 of 20

Specific System Thinking Oversight: The assumption that real-world engineering problems can be solved by purely technical means. Many involve sociological, psychological, economic, legal, maintenance, support, and “soft” human issues. Stow Center School Aquarium. A situation similar to that of Water of Ayolé occurred on a much smaller scale in 2003 at the Center School in Stow, MA, USA. A local university had donated a salt-water aquarium to the school, complete with filtration equipment, temperature regulation, and fish. The students loved the aquarium and were fascinated by its horseshoe crabs and other exotic-looking sea creatures, enjoying it for several years. However, then, components began to wear out and needed replacement, the system needed cleaning and maintenance, and the creatures required regular feeding and assessment. No one had been assigned the responsibility for system maintenance, and teachers (who often felt underpaid) did not feel that maintenance was their responsibility. Eventually, the beautiful, free aquarium was disassembled and scrapped. Specific System Thinking Oversight: Like the Water of Ayolé, there were ancillary support and maintenance issues associated with the aquarium; issues rarely have purely technical solutions. The well-intentioned donors did not realize that this “gift” imposed a burden on the recipients. The Russian K-141 Kursk Submarine Disaster. On 12 August 2000, the Russian Kursk nuclear submarine exploded and sank off the coast of Russia in the Barents Sea; all 118 crewmen were lost. The explosion was traced to a leak of hydrogen peroxide (H2 O2 ) from one of the ship’s torpedoes; the peroxide reacted explosively with copper or brass that was present in the torpedo tube. Both hydrogen peroxide alone and the combination of kerosene and hydrogen peroxide had been used as propellants for rockets and torpedoes since the 1930s [20]. It was well-known that hydrogen peroxide reacts violently in the presence of a silver, copper, or brass catalyst, and previous near-disasters with H2 O2 -powered torpedoes had been well-documented. Because of this risk, hydrogen peroxide/kerosene propellants have been banned by the British and other navies and replaced by newer, safer combinations such as Otto Fuel and Hydroxyl Ammonium Perchlorate [21,22]. When the peroxide leaked from the torpedo and contacted the catalyst on the Kursk, it was converted to oxygen and water vapor, increasing in volume by a factor of 5000. This sudden pressure surge caused a subsequent explosion (equivalent to 500 pounds of TNT) in a nearby kerosene tank and blew a hole in the submarine’s hull. It is thought that the sub then sank within minutes. A few minutes later (and while on the ocean floor), the heat from the kerosene explosion resulted in the detonation of several nearby torpedoes [23]. The explosions blew an immense hole in the sub, and most of the sub’s compartments flooded. Subsequent confusion and lack of transparency by the Russians prevented a rescue of the trapped sailors. Specific System Thinking Oversight: Failure to identify both system component planned inter-relationships and unplanned inter-relationships. The knowledge of the catalytic reaction of hydrogen peroxide with metals (with potentially devastating consequences) should have prevented the co-location of any hydrogen peroxide containers with metal catalysts. The Vdara Hotel, Las Vegas. Las Vegas’s Vdara hotel (Figure 3) was designed by Rafael Viñoly and built in 2008. The hotel’s curved façade focuses the sun’s rays like a parabolic reflector, heating the pool area at its base to over 135 ◦ F—an unintended consequence [24,25]. Employees and visitors refer to the effect as the “Death Ray.” Non-reflective film has been applied to the hotel’s highly-reflective windows and large umbrellas have been placed around the pool area, but the deck still gets hot. The area gets so hot, in fact, that guests have reported burning skin and singed hair within minutes of lying near the focus [26]. Specific System Thinking Oversight: Failure to include relevant environmental components such as the sun and its interaction with other system components.

Systems 2018, 6, 34 Systems 2018, 6, x FOR PEER REVIEW

6 of 20 6 of 20

Figure Figure 3. 3. The The Vdara Vdara Hotel. Hotel.

20 Fenchurch 2020 Fenchurch Street (Figure 4) rises 34 Fenchurch Street, Street, London. London.InInLondon’s London’sfinancial financialdistrict, district, Fenchurch Street (Figure 4) rises stories from the street. Also designed by Rafael ViñolyViñoly and completed in 2014, in the2014, parabolic shape of 34 stories from the street. Also designed by Rafael and completed the parabolic the highly reflective stories focuses sunlight onto a smallonto area aatsmall street area levelat forstreet several hours shape of the highly upper reflective upper stories focuses sunlight level for each day, resulting storefront temperatures 200 °F. An automobile partially melted several hours each in day, resulting in storefrontexceeding temperatures exceeding 200 ◦ F. was An automobile was [27,28] and a reporter fried anaegg on thefried sidewalk [29].onLocal businesses[29]. wereLocal negatively affected by partially melted [27,28] and reporter an egg the sidewalk businesses were the intense affected heat. Thebythermal behavior locals behavior to nickname the building the “Walkie-Scorchie” negatively the intense heat. caused The thermal caused locals to nickname the building [30] and the “Fryscraper” [31].the Louvers, shades,[31]. andLouvers, non-reflective glass been considered as the “Walkie-Scorchie” [30] and “Fryscraper” shades, and have non-reflective glass have remediation measures. been considered as remediation measures.

Figure 4. 20 Fenchurch Street, London.

would think thatthat Viñoly wouldwould have learned his system Specific System SystemThinking ThinkingOversight: Oversight:One One would think Viñoly have learned his definition lesson after theafter Vdara earlier. wasSuch not the Viñoly repeated system definition lesson thedebacle Vdara several debacleyears several yearsSuch earlier. wascase. not the case. Viñoly the error ofthe not including environmental components and theircomponents interrelationships his repeated error of all notrelevant including all relevant environmental and in their design—in this case, the design—in interaction this of the sunthe with the building. interrelationships in his case, interaction of the sun with the building. Toyota In 2007–2010, 2007–2010, several several accidents accidents and and fiery fiery deaths Pedal/Floor Mat Mat Entrapment. Entrapment. In Toyota Gas Gas Pedal/Floor deaths were were Camrys, Avalons, Avalons, Highlanders, Highlanders, Matrixes, Matrixes, attributed to “sudden vehicles. Camrys, “sudden acceleration” acceleration” in Toyota Toyota vehicles. Venzas, Tacomas, Tacomas,and andTundras, Tundras,and and Lexus ES350s, IS250s, IS350s affected Priuses, Venzas, Lexus ES350s, IS250s, andand IS350s werewere affected [32]. [32]. The The problem was at first denied, and then traced to unintended interactions between the vehicles’ floor problem was at first denied, and then traced to unintended interactions between the vehicles’ floor gas pedal would “bond” to mats and accelerator pedals pedals[33]. [33].ItItseems seemsthat thatinincertain certaincircumstances, circumstances,the the gas pedal would “bond” and accelerator to the floor mat resulting in unintended acceleration, inability to slow or stop the vehicle, and

Systems 2018, 6, 34

7 of 20

the floor mat resulting in unintended acceleration, inability to slow or stop the vehicle, and consequent accidents. The company recalled 4.2 million vehicles for floor mat replacements and potential gas pedal redesign. Specific System Thinking Oversight: This is an interesting case (similar to the Kursk) in which the system components were properly identified, but the unintended interactions among components were not. Biodegradable German Car Wiring Insulation. The Green Party in Germany passed a law in the early 1990s that required a certain percentage of the parts in an automobile to be bio-degradable, and the EU followed suit in the mid-1990s. Mercedes-Benz decided to rely on bio-degradable wiring insulation to meet those requirements. Unfortunately, a bio-degradable wiring system that is exposed to the environment will eventually decompose into a mass of short-circuiting copper wires [34]. Specific System Thinking Oversight: This situation is similar to the Galloping Gertie fiasco in which environmental factors (weather) were not adequately considered. The Bhopal Disaster. A Union Carbide pesticide plant in Bhopal, India resulted in 2259 immediate deaths and some 11,000 delayed deaths following an accident in 1984. A highly toxic material called Methyl isocyanate, used in the making of pesticides, became contaminated with water, which caused an exothermic reaction that increased the temperature inside a tank well beyond its capacity. An automated emergency release system vented the extra pressure and a large volume of gasses escaped and spread to the surrounding town, killing over 13,000. If one were to define the “system” as just the pesticide plant, and consider that system in isolation, then the safety sub-system worked pretty well, relieving the pressure and preventing an explosion. However, when including the surrounding town and people in the definition of the “suprasystem” [35], it was an utter disaster. (A “suprasystem” is a larger system that integrates several smaller systems. In our usage here, it means the system proper plus the environment, system users, system controllers and maintainers, communications to and from the system, and power to the system.) Additionally, if the vented gasses had been lighter than air, they might have dispersed without much harm. Unfortunately, those gasses were heavier than air, and seeped into the nearby city of Bhopal at ground level. That leak caused over 550,000 injuries. Specific System Thinking Oversight: This situation is similar to the Galloping Gertie fiasco in which the interactions of the system components with each other and with the environment (people in the surrounding town, weight of gases) were not considered adequately. The Microsoft Zune. In response to Apple’s fabulously successful iPod (released in 2001), Microsoft released its own portable music player, the Zune, in 2006. The Zune did not have the iPod’s aesthetic appeal or “cool” factor [36]. Perhaps more significantly, Microsoft did not appreciate that the Zune and all personal media players are part of a User Experience System, and that, to be successful, all components of that system must be addressed. Steve Jobs and Apple were fabulous at this. Don Norman says, “It is not about the iPod; it is about the system. Apple was the first company to license music for downloading. It provides a simple, easy to understand pricing scheme. It has a first-class website that is not only easy to use but fun as well. The purchase, downloading the song to the computer and thence to the iPod are all handled well and effortlessly. In addition, the iPod is indeed well designed, well thought out, a pleasure to look at, to touch and hold, and to use. There are other excellent music players. No one seems to understand the systems thinking that has made Apple so successful” [37]. Although Microsoft eventually attempted to develop a computer interface, a music subscription service (“Zune Music Pass”), and download capabilities (“MSN Music” and “Zune Marketplace”), those efforts were too little, too late, and the User Experience System was clearly not Microsoft’s focus. The Zune failed commercially and was discontinued in 2011. It should be noted that other portable music device manufacturers (Sony, Diamond, Tascam) also missed the systems thinking aspects of product design: engineering the product is not the same as engineering the User Experience System. Specific Systems Thinking Oversight: Failure to understand that many products are not really stand-alone devices, but instead are merely one component of a User Experience System.

Systems 2018, 6, 34

8 of 20

These failures demonstrate the need to apply Systems Thinking principles (especially appropriate “system” definition, system boundaries, identification of all relevant system and environmental components and relationships, and consideration of feedback mechanisms) to Systems Engineering and design. They are summarized in Table 2. Table 2. Summary of 12 Engineering/Design problems deriving from poor Systems Thinking. Problem

Systems Thinking Issue

Galloping Gertie

Failure to adequately address planned and unplanned interactions between system components and the environment.

Millenium Bridge, London

Failure to adequately address planned and unplanned interactions among system components themselves and between system components and the environment.

Lockheed L-188 Electra Turboprop Airplane

Failure to adequately address planned and unplanned interactions among system components themselves and between system components and the environment.

Water of Ayolé

Failure to bound the system properly; specifically, to understand that most complex problems cannot be solved by purely technological means; they often involve organizational, political, economic, environmental, ethical, and sociological components.

Stow Center School Aquarium

Failure to bound the system properly; specifically, to understand that most complex problems cannot be solved by purely technological means; they often involve organizational, political, economic, environmental, ethical, and sociological components.

Russian K-141 Kursk Submarine

Failure to adequately address planned and unplanned interactions among system components themselves and between system components and the environment.

Vdara Hotel

Failure to identify relevant environmental factors.

20 Fenchurch Street, London

Failure to identify relevant environmental factors.

Toyota Gas Pedal

Failure to adequately address planned and unplanned interactions among system components themselves and between system components and the environment.

Biodegradable German Car Wiring Insulation

Failure to identify relevant environmental factors.

Bhopal, India

Failure to identify relevant environmental factors; specifically, interactions between the system and neighboring people and between the system and environmental gases.

Microsoft Zune

Failure to recognize that many products are actually components of a User Experience System

It is interesting that the Systems Thinking failures explaining these 12 problems fall into just four categories: a. b.

c. d.

Failure to identify relevant environmental factors such as wind, insolation, rain, and temperature; Failure to understand that most complex problems cannot be solved by purely technological means; they often involve organizational, political, economic, environmental, ethical, and sociological components. Failure to adequately address both planned and unplanned interactions among the system components themselves and between system components and the environment. Failure to recognize that many products are actually components of a User Experience System.

2. How to Engineer and Design Systems to Avoid Similar Issues 2.1. Identification of Relevant Environmental Factors such as Wind, Insolation, Rain, Temperature Failure to identify a system’s relevant environmental factors can result in disaster. In the Biodegradable German Car Wiring Insulation debacle, failure to consider normal weather impacts on the insulation caused catastrophic failures. In the Vdara hotel situation (and the 20 Fenchurch Street example), failure to consider the interaction of the building with the sun yielded poor results.

Systems 2018, 6, x FOR PEER REVIEW Systems 2018, 6, 34

9 of 20 9 of 20

on the insulation caused catastrophic failures. In the Vdara hotel situation (and the 20 Fenchurch Street failure to consider the what interaction building with the sun results. It example), is sometimes difficult to decide is partofofthe a system versus what isyielded part of poor the system’s It is sometimes difficult to decide what is part of a system versus what is part of the system’s environment. Kossiakoff [2] suggests four criteria to decide which elements are system versus environment. Kossiakoff [2] suggests four criteria to decide which elements are system versus environmental components: environmental components: 1. Developmental Control: the ability of the system designer to control the component; 1. Developmental Control: the ability of the system designer to control the component; 2. Operational Control: the ability of the system operator to control the component; 2. Operational Control: the ability of the system operator to control the component; 3. Functional Allocation: the ability of the system designer/operator to assign functions to 3. Functional Allocation: the ability of the system designer/operator to assign functions to the the component; component; 4. Unity of Purpose: Purpose:thethe degree to which the component is dedicated to the successful system’s 4. Unity of degree to which the component is dedicated to the system’s successful performance. performance. Components Components for for which which these these four four criteria criteria score score low low are are defined defined as as environmental environmental (not (not system) system) components. Kossiakoff suggests depicting system boundaries using a Context Diagram (see components. Kossiakoff suggests depicting system boundaries using a Context Diagram (see Figure Figure 5, 5, adapted adaptedfrom fromJohns JohnsHopkins Hopkins[38]). [38]).

Figure Figure5.5. System Systemcontext contextdiagram diagram[38]. [38].

The The context context diagram diagramnotes notesadditional additionalentities entities(environment, (environment,users, users,maintainers, maintainers,etc.) etc.) that that must must be beconsidered consideredin insystem systemdesign. design. For For present present purposes, purposes, we we will will focus focus on on the the environment. environment. To To identify identify environmental environmentalfactors factorsthat thatmay mayimpact impactsystem system performance, performance, more moredetail detail and and specificity specificityare arerequired required for both system and environmental components. An excellent tool for this is the System Breakdown for both system and environmental components. An excellent tool for this is the System Breakdown Structure Structureor orSBS. SBS. An SBS An SBSisisaa hierarchical hierarchicalpictogram pictogramshowing showingthe thesystems, systems,environment’s, environment’s,and anduser’s user’s components components (see Figure 6). (Subsequently, the interrelationships among these components will be described; (see Figure 6). (Subsequently, the interrelationships among these components will be described; but but first the components themselves must be identified.) Additional sublevels may be to first the components themselves must be identified.) Additional sublevels may be added to added whatever whatever degree is necessary. For example, Sub-System 1 may comprise several sub-sub-systems. degree is necessary. For example, Sub-System 1 may comprise several sub-sub-systems. Often, nonOften, non-Systems Thinkers focus on the tangible physical components of a system; lead Systems Thinkers focus only on only the tangible physical components of a system; thisthis cancan lead to to problems as made evident by Table 2. Note that Figure 6 represents a good starting point for an problems as made evident by Table 2. Note that Figure 6 represents a good starting point for an SBS; SBS; however, however,ititshould shouldbe betailored tailoredfor foreach eachspecific specificsystem systemdesign. design.For Forexample, example,designers designers of of offshore offshoreoil oil rigs would need to include more environmental factors related to seas, the ocean floor, and underwater rigs would need to include more environmental factors related to seas, the ocean floor, and life. The toplife. levels thelevels SBS correspond to the elements Figure in 5; Figure however, the SBS underwater Theoftop of the SBS correspond to the depicted elements in depicted 5; however, contains much more detail and a level ofaspecificity that is actionable. the SBS contains much more detail and level of specificity that is actionable.

Systems 2018, 6, 34

10 of 20

Systems 2018, 6, x FOR PEER REVIEW

10 of 20

SupraSystem System

Environment Weather/ClimateRelated

Sub-System 1 Component 1

Precipitation

Component 2

Rain

etc.

Temperature

Snow

Users

Geological Earthquakes

Geographic Features Rivers

Volcanos

Landscapes

Tsunamis

Forests

etc.

Sleet, Hail

etc.

Meadows

Sub-System 2 Roadways

Freezing Rain Sub-System 3 etc.

etc.

etc.

Insolation

Wind

Radiation

Hurricanes, Tornadoes

Pollutants

etc.

Figure 6. System breakdown structure (SBS). Figure 6. System breakdown structure (SBS).

2.2. Bounding the System Properly with Respect to Understanding That Most Complex Problems Cannot Be 2.2. Solved Bounding System Properly with Respect Understanding That Most Complex Problems Cannot Be by the Purely Technological Means; TheytoOften Involve Organizational, Political, Economic, Environmental, Solved by Purely Technological Means; They Often Involve Organizational, Political, Economic, Ethical, and Sociological Components Environmental, Ethical, and Sociological Components In the Water of Ayolé example, a narrow perspective of the problem as only an engineering issue In the Water of Ayolé narrow perspective of the problem assituation. only an engineering issueoversight. led to failure. This wasexample, repeatedain the Stow Center School aquarium It is a common led Few to failure. This was repeated in the Stow Center School aquarium situation. It is a common technical issues do not have human, environmental, economic, sociological, or emotional issues oversight. Few with technical do not have human, environmental,dealing economic, or aspects associated them,issues yet many engineers are uncomfortable withsociological, these “softer” emotional issues associated with them, yet many engineers are uncomfortable dealing with these of engineering. “softer” aspects of engineering. In Ayolé, the government assumed that installing pumps would solve the water problem. However, In Ayolé, the government assumed that installing pumps would solve the water problem. three years after installation, the pumps were no longer functional. The following sub-systems needed However, three years after installation, the pumps were no longer functional. The following subto be created and installed to fully solve the problem: systems needed to be created and installed to fully solve the problem: i. AAwater waterand and pump operation training education system; pump operation training andand education system; ii. AAcultural cultural sensitivity system; sensitivity system; iii. AApump pumpmaintenance maintenance and repair system; and repair system; forfor repair parts; iv. AAsupply supplychain chain repair parts; and management system, including a farming sub-system; v. AAmoney-generation money-generation and management system, including a farming sub-system; vi. A village/social organization to appropriately divide the labor and decision-making. vi. A village/social organization to appropriately divide the labor and decision-making. It is not hard to generalize from these examples when designing or engineering a new or It is not hard to generalize from these examples when designing or engineering a new or modified system: modified system: i. Will the new system or systemic change require any cultural adjustment? If so, cultural i. sensitivity Will the new systemic change require any cultural adjustment? If so, cultural sensitivity and system trainingorwill be required. andthe training will berequire required. ii. Will new system training and education in its use, benefits, and maintenance? Willa the new system requireand training education use, benefits, and maintenance? iii. ii. Will cleaning, maintenance, repairand system need toin beits established? iii. Will a cleaning, maintenance, and repair system need to be established? i. ii. iii. iv. v.

Systems 2018, 6, x FOR PEER REVIEW Systems 2018, 6, x FOR PEER REVIEW Systems 2018, 6, 34

11 of 20 11 of 20 11 of 20

iv. Will iv. Will aa repair repair parts parts supply supply chain chain need need to to be be established? established? v. Is there a means to pay for repair, maintenance, legal a means to paychain for repair, legal issues, issues, decommissioning? decommissioning? iv.v. WillIsathere repair parts supply need maintenance, to be established? v. Adequately Is there a means to pay for repair, and maintenance, legal issues, decommissioning? 2.3. 2.3. Adequately Addressing Addressing Both Both Planned Planned and Unplanned Unplanned Interactions Interactions among among the the System System Components Components Themselves and between System Components and the Environment Themselves and between System Components and the Environment 2.3. Adequately Addressing Both Planned and Unplanned Interactions among the System Components Themselves and between System Components and the Environment Several Several of of the the examples examples listed listed (Kursk, (Kursk, Galloping Galloping Gertie, Gertie, Lockheed Lockheed Electra, Electra, Millennium Millennium Bridge, Bridge, Toyota Gas Pedal, Biodegradable German Car Wiring, Bhopal) resulted from failure to identify Several of the examples listed (Kursk, Galloping Gertie, Lockheed Electra, Millennium Bridge, Toyota Gas Pedal, Biodegradable German Car Wiring, Bhopal) resulted from failure to identify potential interactions among system components, or between system components and Toyota Gasinteractions Pedal, Biodegradable Wiring, Bhopal) resulted from failure to identify potential potential among German system Car components, or between system components and the the environment. Several tools are available to minimize the probability of overlooking these interactions among system components, or between system components and theofenvironment. environment. Several tools are available to minimize the probability overlookingSeveral these relationships: tools are available to minimize the probability of overlooking these relationships: relationships: 2.3.1. 2.3.1. System Interrelationship Interrelationship Matrix Matrix 2.3.1. System System Interrelationship Matrix One the best tools for identifying planned and unplanned relationships system One of among One of of the the best best tools tools for for identifying identifying planned planned and and unplanned unplanned relationships relationships among among system system components and among system and environment components is the System Interrelationship components and environment environment components components is the System System Interrelationship Interrelationship Matrix Matrix components and and among among system system and is the Matrix or SIM. One constructs the SIM by listing all system and environmental components on both axes of or SIM. One constructs the SIM by listing all system and environmental components on both axes or SIM. One constructs the SIM by listing all system and environmental components on both axes of aof two-dimensional matrix, as shown in Figure 7. Then, one places an X in every cell representing an a two-dimensional matrix, as shown in Figure 7. Then, one places an X in every cell representing a two-dimensional matrix, as shown in Figure 7. Then, one places an X in every cell representing an interaction between the One by (in to of an interaction between the components. One add maydetail add detail by noting (in addition to the thetype X) the interaction between the components. components. One may may add detail by noting noting (in addition addition to the the X) X) the type of interaction: for example, command-control, mechanical, chemical, emotional/psychological, type of interaction: for example, command-control, mechanical, chemical, emotional/psychological, interaction: for example, command-control, mechanical, chemical, emotional/psychological, organizational, organizational, frictional. One Onemay may make make aaa single single matrix matrix for for the the entire entire suprasystem, suprasystem, or one one may may organizational, frictional. frictional. One may make single matrix for the entire suprasystem, or or one may develop smaller, more tractable SIMs for sub-levels or components, as shown in Figure 8 develop smaller, more tractable SIMs for sub-levels or components, as shown in Figure 8 for develop smaller, more tractable SIMs for sub-levels or components, as shown in Figure 8 for for automobile components. automobile components. automobile components.

Figure Figure 7. 7. SIM level of of an an automobile. automobile. SIM for for the the highest highest level

SIM for the the Figure Figure 8. 8. SIM SIM for for the components components of of an an automobile automobile suspension. suspension.

Systems 2018, 6, 34 Systems 2018, 6, x FOR PEER REVIEW Systems 2018, 6, x FOR PEER REVIEW

12 of 20 12 of 20 12 of 20

System Interrelationship Interrelationship matrices matrices have have the the great great benefit benefit of of comprehensiveness; comprehensiveness; however, however, they System System Interrelationship matrices have the great benefit of comprehensiveness; however, theythey can can become unwieldy. can become unwieldy. become unwieldy. 2.3.2. Stock-and-Flow Diagrams 2.3.2. Stock-and-Flow Stock-and-Flow Diagrams Diagrams 2.3.2. Stock and Flow diagrams depict the interrelationships among system components, and between Stock and and Flow Flowdiagrams diagramsdepict depictthe theinterrelationships interrelationships among among system system components, components, and and between between Stock systems and their environments, from a control volume perspective. Monat and Gannon [39] state, systems and their environments, from a control volume perspective. Monat and Gannon [39] state, systems and their environments, from a control volume perspective. Monat and Gannon [39] state, “In systems, some quantities are stored while others flow. These may be real physical quantities such are stored stored while others others flow. flow. These may may be be real real physical physical quantities quantities such such “In systems, some quantities are as dollars, volume of water, number of customers, or number of cabbages in a field. They may also as dollars, dollars, volume of water, a field. They may also be as water, number numberof ofcustomers, customers,orornumber numberofofcabbages cabbagesinin a field. They may also be non-physical quantities such as love, anger, greed, or other emotions. Stores or accumulations of non-physical quantities such as love, anger, greed, or other emotions. Stores or accumulations of these be non-physical quantities such as love, anger, greed, or other emotions. Stores or accumulations of these items are called “stocks”. Stocks increase or decrease as quantities flow into or out of them. Like itemsitems are called “stocks”. StocksStocks increase or decrease as quantities flow into orinto out or of out them. Like causal these are called “stocks”. increase or decrease as quantities flow of them. Like causal loop diagrams, stock-and-flow diagrams are helpful in understanding systemic behavior.” An loop diagrams, stock-and-flow diagrams are helpful in understanding systemic behavior.” An example causal loop diagrams, stock-and-flow diagrams are helpful in understanding systemic behavior.” An example of aa stock-and-flow stock-and-flow diagram is shown in Figure 9. 9. of a stock-and-flow diagram diagram is shownis inshown Figurein 9. Figure example of

Figure 9. Stock-and-flow diagram for domestic heating system control. Figure9. 9.Stock-and-flow Stock-and-flowdiagram diagramfor fordomestic domestic heating heating system system control. control. Figure

A weakness weakness of of stock-and-flow stock-and-flow diagrams diagrams is that is hard hard to to determine determine ifif one one has has been been diagrams is is that that itit is A comprehensive in flows. in showing showing all all stocks stocks and and flows. flows. comprehensive 2.3.3. Causal Causal Loop Loop Diagrams Diagrams 2.3.3. may be used to show cause-and-effect Causal Loop Loop Diagrams Diagrams (CLDs) (CLDs) are are another another tool tool that that may Causal be used to show cause-and-effect among system and environmental components. They are especially helpful in depicting relationships components. relationships among system and environmental components. They are especially helpful in depicting feedback processes, which are present in most systems. Some feedback loops (such as the stabilizing feedback processes, which are present in most systems. Some feedback loops (such as the stabilizing a Proportional-Integral-Differential (PID)(PID) controller or the reinforcing feedback feedback mechanism mechanismofof of Proportional-Integral-Differential controller or the the reinforcing reinforcing feedback mechanism aa Proportional-Integral-Differential (PID) controller or mechanism of compound interest) are obvious, whereas some (financial bailouts, trade tariffs) are feedback mechanism of compound interest) are obvious, whereas some (financial bailouts, trade feedback mechanism of compound interest) are obvious, whereas some (financial bailouts, trade more subtle. tariffs) are more more subtle. subtle. tariffs) are simple version of a domestic heating system CLD is shown in Figure 10. An extremely CLD is is shown shown in in Figure Figure 10. 10. An extremely simple version of a domestic heating system CLD

Figure 10. 10. Domestic heating system causal loop diagram. Figure Figure 10. Domestic heating system causal loop diagram.

CLDs can become complicated as various cause-and-effect relationships are are identified and CLDs can become become complicated complicated as as various various cause-and-effect cause-and-effect relationships relationships identified and and CLDs can are identified depicted. A more complicated CLD (related to the Water of Ayolé example) is shown in Figure 11. depicted. A A more more complicated complicated CLD CLD (related (related to to the the Water Water of of Ayolé Ayolé example) example) is is shown shown in in Figure Figure 11. 11. depicted. This CLD highlights the interactions among the water system and the sociological impacts of This CLD CLD highlights highlights the the interactions interactions among among the the water water system system and and the the sociological sociological impacts impacts of of the the This the system. system. system.

Systems 2018, 6, x FOR PEER REVIEW Systems 2018, 6, 34 Systems 2018, 6, x FOR PEER REVIEW

13 of 20 13 of 20 13 of 20

Figure 11. CLD for the Water of Ayolé Example. The solid arrows represent the initial effort; the Figure 11. CLD for the Water of Ayolé Example. The solid arrows represent the initial effort; the dashed dashed represent additional structure after thesolid finalarrows effort. represent the initial effort; the Figure arrows 11. CLD for the the Water of Ayolé Example. The arrows represent the additional structure after the final effort. dashed arrows represent the additional structure after the final effort.

As As for for stock-and-flow stock-and-flow diagrams, diagrams, CLDs CLDs are are useful, useful, but but itit is is hard hard to to determine determine ifif one one has has been been comprehensive in capturing all interrelationships. CLDs are explained in greater detail in The Systems As for stock-and-flow diagrams, CLDs are useful, butexplained it is hardintogreater determine been comprehensive in capturing all interrelationships. CLDs are detailifinone Thehas Systems Thinker [40] and in Kim [41]. comprehensive capturing all interrelationships. CLDs are explained in greater detail in The Systems Thinker [40] and in Kim [41]. Thinker [40] and in Kim [41]. 2 2.3.4. 2.3.4. N N2Diagrams Diagrams 2.3.4.An N2NDiagrams 2 2 An N2 chart chart or or N N2 diagram diagram isis an an N N xx N N matrix matrix designed designed to to show show interfaces interfaces based based on on system system 2 2 function. Various system functions are plotted on the matrix diagonal; inputs are shown vertically An NVarious chart system or N diagram is are an N x N matrix to showinputs interfaces based on system function. functions plotted on thedesigned matrix diagonal; are shown vertically 2 (up or and are shownare horizontally or right). A N is in function. Various system functions plotted on (left the matrix diagonal; inputs are shown vertically (up or down) down) and outputs outputs are shown horizontally (left or right). A generic generic N2 diagram diagram is shown shown in 2 diagram is shown in Figure 12 while a specific one is shown in Figure 13. (up or down) and outputs are shown horizontally (left or right). A generic N Figure 12 while a specific one is shown in Figure 13. Figure 12 while a specific one is shown in Figure 13.

Figure Figure 12. 12. Generic Generic N N22diagram diagramfrom fromFAA FAA [42]. [42]. Figure 12. Generic N2 diagram from FAA [42].

Feedback loops loops may may be be shown shown as as closed closed circles circles and and critical critical functions functions are are identified identified as as cells cells in in Feedback 2 several NN2diagrams are it are is clear thatas they are whichFeedback several circles circles intersect. diagrams areuseful usefulconstructs; constructs; however, it not isidentified not clear that they loopsintersect. may be shown as closed circles and criticalhowever, functions cells in comprehensive and identify all interactions. For example, they show only interfaces between functions; 2 are comprehensive and identifyNalldiagrams interactions. For example, theyhowever, show only which several circles intersect. are useful constructs; it isinterfaces not clear between that they some system and system environment components are notFor functions therefore those interrelationships functions; some and environment components areand not functions andinterfaces thereforebetween those are comprehensive and identify all interactions. example, they show only may be missed. interrelationships may be missed. functions; some system and environment components are not functions and therefore those

interrelationships may be missed.

Systems 2018, 6, 34

Systems 2018, 6, x FOR PEER REVIEW

14 of 20

14 of 20

Figure13. 13. Specific SpecificN N22diagram diagramfor for“Functional “FunctionalFlow Flowof ofOperations” Operations”for forUF UF6 6cylinder cylindermanagement, management, Figure from Bechtel Jacobs Company, (Oak Ridge, TN USA) [43]. from Bechtel Jacobs Company, (Oak Ridge, TN USA) [43].

2.3.5. SV-3 System-System Matrix 2.3.5. SV-3 System-System Matrix The SV-3 Systems-Systems Matrix is a Department of Defense (DoD) construct designed The SV-3 Systems-Systems Matrix is a Department of Defense (DoD) construct designed to to summarize system resource interactions, manage interfaces, and compare interoperability summarize system resource interactions, manage interfaces, and compare interoperability characteristics of solution options [44]. The DoD website states, “The SV-3 is generally presented as a characteristics of solution options [44]. The DoD website states, “The SV-3 is generally presented as matrix, where the Systems resources are listed in the rows and columns of the matrix, and each cell a matrix, where the Systems resources are listed in the rows and columns of the matrix, and each cell indicates an interaction between resources if one exists. Many types of interaction information can be indicates an interaction between resources if one exists. Many types of interaction information can be presented in the cells of a SV-3. The resource interactions can be represented using different symbols presented in the cells of a SV-3. The resource interactions can be represented using different symbols and/or color coding that depicts different interaction characteristics, for example: and/or color coding that depicts different interaction characteristics, for example: Status(e.g., (e.g.,existing, existing,planned, planned,potential, potential,de-activated); de-activated); a.a. Status Keyinterfaces; interfaces; b.b. Key c. Category (e.g.,command commandand andcontrol, control,intelligence, intelligence,personnel, personnel,logistics); logistics); c. Category (e.g., d. Classification-level Classification-level(e.g., (e.g.,Restricted, Restricted,Confidential, Confidential,Secret, Secret,Top Top Secret); Secret); d. e. Communication means (e.g., Rim Loop Interface, Scalable Loop Interface).” e. Communication means (e.g., Rim Loop Interface, Scalable Loop Interface).”

An based upon upon the thedevelopment developmentofofthe theMobil MobilSpeedPass, SpeedPass,isisshown shown Anexample example of of an an SV-3 SV-3 matrix, based in in Figure Figure 14.14.

Systems 2018, 6, x FOR PEER REVIEW Systems 2018, 6, x FOR PEER REVIEW

15 of 20 15 of 20

Systems 2018, 6, 34 Systems 2018, 6, x FOR PEER REVIEW

15 of 20 15 of 20

Figure 14. matrix [45]. Figure 14. 14. Mobil Mobil SpeedPass SpeedPass SV-3 SV-3 matrix matrix [45]. [45]. Figure Figure 14.Mobil MobilSpeedPass SpeedPass SV-3 SV-3 matrix [45].

One weakness of SV-3 is that it depicts interfaces only among systems and subsystems, not One weakness ofofthe the SV-3 isis that interfaces only among systems andand subsystems, not One the thatitititdepicts depicts interfaces only among systems subsystems, One weaknessof the SV-3 SV-3some is that depicts interfaces only among systems and subsystems, not among components. Therefore, key interrelationships may be missed. among components. Therefore, some key interrelationships may be missed. not among components. Therefore, some key interrelationships may be missed. among components. Therefore, some key interrelationships may be missed. 2.4. Recognizing That That Many Many Products Are Part of a Larger User Experience System 2.4. Recognizing System 2.4.2.4. Many Products Are Part of Larger User Experience ExperienceSystem System Recognizing That ManyProducts ProductsAre ArePart Partof ofaaaLarger Larger User User Experience Steve Jobs, founder of Apple Computer was aa great Systems Thinker. He recognized that most Steve founder Apple Computer was a great Systems Thinker. He recognized that Steve Jobs, founder was Systems Thinker. Herecognized recognized that most Steve Jobs, founderofof ofApple AppleComputer Computer was a great great Systems Thinker. He that most consumer products are not stand-alone products, but part of experiential consumer use systems. While most consumer products are not stand-alone products, but part of experiential consumer use systems. consumer products are of experiential experientialconsumer consumeruse usesystems. systems. While consumer products arenot notstand-alone stand-aloneproducts, products, but part of While competitors like Sony, Tascam, Microsoft, and Diamond structured their companies around their While competitors like Sony, Tascam, Microsoft, and Diamond structured their companies around their competitors like Tascam, Microsoft, and Diamond structured their companies around their competitors likeSony, Sony, Tascam, Microsoft, and Diamond structured their companies around their products (such as portable music players), Jobs structured Apple around the consumer’s experience, products (such as portable around the consumer’s experience, products (such asas portable music players), Jobs structured Applearound aroundthe theconsumer’s consumer’s products (such portablemusic musicplayers), players),Jobs Jobsstructured structured Apple Apple experience, of which the product (in this case the iPod) was just one component. Thedevice device itselfisis is just one of the product (in The device itself just one of which product (inthis thiscase casethe theiPod) iPod)was wasjust one component. one of which which thethe product (in this case the iPod) was just one one component. component.The deviceitself isjust just one element of listening to music; other elements include the means of acquiring the music, the user’s element listening music;other otherelements elementsinclude include the the means user’s element of listening to music; of acquiring the music, the user’s element of of listening toto music; other elements include the means means of ofacquiring acquiringthe themusic, music,the the user’s activities while listening, the environment while listening, and the prestige/coolness factor that may activities while listening, theenvironment environmentwhile whilelistening, listening, and and that may activities while listening, the prestige/coolness factor that may activities while listening, the environment while listening, andthe theprestige/coolness prestige/coolnessfactor be associated with both the product and the listening experience [37] (see Figures 15 and 16). be associated with both the productand andthe thelistening listeningexperience experience [37] 16). be with both the product [37] (see Figures 15 and 16). be associated associated with both the product and the listening experience [37](see (seeFigures Figures15 15and and 16).

Figure 15.Sony, Sony, Tascam,Microsoft, Microsoft, Diamond Diamond Structure [39]. Figure Structure [39]. 15. Sony, Tascam, Tascam, Figure 15. Tascam, Microsoft, Microsoft, Diamond DiamondStructure Structure[39]. [39].

Figure 16. Apple structure [39]. Figure Figure 16. 16. Apple Apple structure structure [39]. [39].

Systems 2018, 6, 34

16 of 20

The iPod (and in fact most Apple products) was developed using similar innovative Systems Thinking focused on the user’s experience as opposed to the product. It is natural to ask if other products should be considered through this innovative Systems Thinking “experiencing” versus “owning” lens:

•

•

•

•

•

The automobile as a stand-alone product versus the car buying and owning experience. Car ownership involves car purchase, registration, annual inspections, maintenance, and disposal or trade-in as well as insurance. Cars wear out and new technology renders older models obsolete. There is no good reason that car dealers could not provide all these services for a fixed monthly fee. Some dealerships have already started down this path with service areas that provide free meals, entertainment, and drop-off services. Several manufacturers (Volvo, Cadillac, BMW) have adopted new “subscription services” in which a fixed monthly fee is paid by the user to cover lease, insurance, maintenance, and other expenses [46]. Coffee. Is it the coffee itself, or is it the coffee-drinking experience? Starbucks (and others) attracts clients to not only buy and drink coffee, but to enjoy the coffeehouse experience, with free Wi-Fi, comfortable seating, and even fireplaces in some establishments. Clothes versus the clothes buying and owning experience. Clothes use involves clothing selection, travel to a store, fitting, matching, laundering and pressing, repair, and disposal. While many do not mind (or even enjoy) these activities, some do not. Enterprising Systems Thinking businesses could assume all these functions for a fixed monthly fee, thus providing a clothes use experience in which the clothes themselves are merely adjuncts. Flat Panel TV versus the home entertainment system experience. To many people, the home theater component selection, purchase, matching, interconnection, and set up is a harrowing experience. A Systems Thinking approach by subscription TV service providers (Comcast, Verizon, DirecTV, DishTV, etc.) would dictate that these onerous functions be included in the monthly subscription. This would ensure that users would always have the latest equipment set up and functioning optimally to receive the provider’s streaming content. It would be similar to a razor-blade or inkjet printer business model in which the asset (in this case the TV and associated hardware) is provided free or near-free to encourage the user to consume the razor blades or ink (in this case, the streaming services). Home Ownership. Certainly many houses are rented today; however, house buyers must assume the responsibility for lawn and yard maintenance, utilities, snow removal, pool maintenance, insurance, and all the other onerous responsibilities that come with home ownership. A Systems Thinking approach to the home owning experience would bundle these items in with monthly mortgage payments such that the owner pays one monthly fee for all home owning tasks and services, which are then provided by the mortgage company or their representatives.

There are other examples for which close inspection (from a Systems Thinking perspective) reveals that the product is really just a part of a User Experience System. 3. Procedure The Systems Engineering procedure is described well by Blanchard and Fabrycki [47] and by Kossiakoff et al. [2]. The principle steps are: 1. 2. 3. 4. 5. 6. 7. 8.

Regional Architecture/Scoping the Problem; Feasibility Study/Concept Exploration; Concept of Operations; System Requirements; High-Level Design; Detailed Design; Software/Hardware Development/Field Installation; Unit Device Testing;

Systems 2018, 6, 34

9. 10. 11. 12. 13. 14.

17 of 20

Subsystem Validation; System Verification and Deployment; System Validation; Operations and Maintenance; Changes and Upgrades; Retirement/Replacement.

Many of the engineering and design failures described earlier in this paper were the result of failures to bound the system properly, specifically interactions with environmental factors, and failures to adequately address planned and unplanned interactions among system components themselves and between system components and the environment. Those failures were the result of inadequate scoping of the problem (Step 1 above), which is directly related to the Systems Thinking concepts of Holistic Perspective/Proper Definition of System Boundaries and a Focus on Relationships. If the boundaries and interactions of a system with its environment are not defined properly at the onset of the Systems Engineering process, each of the subsequent steps in that process will be focused on incomplete or inaccurate requirements. The high-level and detailed design of the system will not take into account critical interactions of the system with its environment. Moreover, the Verification and Validation of the system will be incomplete and not consider those interactions of the system with its environment, which could result in catastrophic failure of the system. To avoid similar failures from arising in the future, a holistic perspective must be taken at the beginning of the Systems Engineering lifecycle, and revisited often throughout that lifecycle. A wide range of relationships among many of the system components themselves and the environment in which the system is intended to operate must be considered. That range of relationships should also include organizational, political, economic, environmental, ethical, and sociological factors. The tools described above are instrumental in achieving this. Finally, many engineered products (automobiles, appliances, tools, entertainment devices, clothing, prepared foods, engineered homes, etc.) are merely components of a User Experience System. Systems Thinking requires that engineers pay attention to all aspects of this system when designing products. 4. Conclusions and Recommendations Engineers can sometimes be excused for problems that have never before been observed. However, we should learn from our mistakes. The problems associated with several of the examples listed in this paper had been previously observed and documented, but that information was either not researched, ignored, or (more likely) not available in an organized, actionable way. Systems Thinking helps organize some historical engineering and design errors into a set of principles that can be beneficial and actionable. Taking a holistic view and focusing on relationships (as opposed to system components) can minimize the chances of engineering and design gaffs. In this paper, we analyzed 12 Systems Engineering failures and found that they could be categorized into four types of Systems Thinking errors: failure to identify relevant environmental factors, failure to understand that most complex problems cannot be solved by purely technological means, failure to adequately address both planned and unplanned interactions among the system components themselves and between system components and the environment, and failure to recognize that many products are actually components of a User Experience System. Several tools are available to address these issues: 1.

Early in the design process, system engineers must ensure that they have captured all relevant components of the system, as well as the suprasystem in which the system of interest resides. Environmental factors such as wind, insolation, temperature, and the potential for dramatic incidents such as earthquakes, tsunamis, and hurricanes are notorious for being overlooked. The System Breakdown Structure (SBS) is an excellent tool for this.

Systems 2018, 6, 34

2.

3.

4.

18 of 20

Once the relevant components of the system of interest and its suprasystem have been properly identified, all relevant relationships must be identified. The System Interrelationship Matrix (SIM) is an excellent tool for this. Stock-and-Flow diagrams and Causal Loop diagrams may also be helpful. Having identified all relevant system components and interrelationships, systems engineers must then realize that very few complex problems have purely technological solutions. Engineers also must consider the sociological, psychological, ethical, political, cultural, and economic factors that may impact the success of a complex system. Finally, in designing complex systems, engineers must understand that “products” are very often not stand-alone devices or systems, but instead part of a user experience system that comprises the user, the environment, aesthetics, psychological factors, system acquisition, maintenance, upgrades, and disposal. Failure to address these ancillary factors may cause the system to fail, either technically or commercially.

We recommend that these tools be applied during the first few steps of the standard System Engineering design process to avoid catastrophic Systems Engineering failures in the future. Author Contributions: Conceptualization, J.P.M. and T.F.G.; Methodology, J.P.M.; Validation, J.P.M. and T.F.G.; Formal Analysis, J.P.M. and T.F.G.; Investigation, J.P.M. and T.F.G.; Writing-Original Draft Preparation, J.P.M. and T.F.G.; Writing-Review & Editing, J.P.M. and T.F.G.; Visualization, J.P.M. Funding: This research received no external funding. Conflicts of Interest: The authors declare no conflicts of interest.

References 1. 2. 3. 4. 5. 6. 7.

8.

9. 10. 11. 12. 13.

Monat, J.P.; Gannon, T.F. What is Systems Thinking? A Review of Selected Literature Plus Recommendations. Am. J. Syst. Sci. 2015, 4, 2. Kossiakoff, A.; Sweet, W.; Seymour, S.; Biemer, S. Systems Engineering: Principles and Practice, 2nd ed.; Wiley: Hoboken, NJ, USA, 2011. Lawson, H. A Journey Through the Systems Landscape; College Publications: London, UK, 2010; p. 6. Boyd, J.R. An Organic Design for Command and Control, a Discourse on Winning and Losing. Maxwell Air Force Base, Alabama Air University, Montgomery, AL, USA. Unpublished lecture notes, 1987. Shewhart, W.A. Statistical Method from the Viewpoint of Quality Control; U.S. Department of Agriculture: Dover, UK, 1939; p. 45. Kasser, J.; Mackley, T. Applying systems thinking and aligning it to systems engineering. INCOSE Int. Symp. 2008, 18, 1389–1405. [CrossRef] Godfrey, P. What is Systems Thinking? How does it relate to Systems Engineering? INCOSE UK zGuide 7, Issue 1. March 2010. Available online: https://incoseonline.org.uk/Program_Files/Publications/zGuides_7. aspx?CatID=publications&SubCat=zGuides (accessed on 10 April 2018). Pyster, A.; Olwell, D.; Hutchison, N.; Enck, S.; Anthony, J.; Henry, D.; Squires, A. (Eds.) Guide to the Systems Engineering Body of Knowledge (SEBoK), version 1.0; The Trustees of the Stevens Institute of Technology: Hoboken, NJ, USA, 2012; pp. 98–125. Available online: http://www.sebokwiki.org (accessed on 29 March 2018). INCOSE. INCOSE, Systems Engineering Handbook, 4th ed.; INCOSE-TP-2003-002-04-2015; Wiley: Hoboken, NJ, USA, 2015; pp. 18–21. Burge, S.E. Systems Engineering: Using Systems Thinking to Design Better Aerospace Systems. In Encyclopedia of Aerospace Engineering; John Wiley & Sons, Ltd.: Hoboken, NJ, USA, 2010. Frank, M. Engineering Systems Thinking: Cognitive Competencies of Successful Systems Engineers. Procedia Comput. Sci. 2012, 8, 273–278. [CrossRef] Billah, K.Y.; Scanlan, R.H. Resonance, Tacoma Narrows bridge failure, and undergraduate physics textbooks. Am. J. Phys. 1991, 59, 118–124. [CrossRef] Petroski, H. Design Paradigms—Case Histories of Error and Judgment in Engineering; Cambridge University Press: New York, NY, USA, 1994; pp. 156–165.

Systems 2018, 6, 34

14.

15. 16. 17. 18.

19.

20. 21. 22. 23. 24.

25.

26.

27.

28. 29. 30.

31.

32.

33.

34.

19 of 20

Gaal, R. This Month in Physics History, November 7, 1940: Collapse of the Tacoma Narrows Bridge. APS News. November 2016, Volume 25. Number 10. Available online: https://www.aps.org/publications/ apsnews/201611/physicshistory.cfm (accessed on 14 August 2018). Dallard, P.; Fitzpatrick, A.J.; Flint, A.; le Bourva, S.; Low, A.; Smith, R.M.R.; Willford, M. The London Millennium Footbridge. Struct. Eng. 2001, 79, 17–35. Josephson, B. Out of Step on the Bridge. Guardian Letters. 14 June 2000. Available online: https://www. theguardian.com/theguardian/2000/jun/14/guardianletters3 (accessed on 7 May 2018). Strogatz, S.; Abrams, D.M.; McRobie, A.; Eckhardt, B.; Ott, E. Theoretical Mechanics: Crowd Synchrony on the Millennium Bridge. Nature 2005, 438, 43–44. [CrossRef] [PubMed] Bachmann, H.; Ammann, W. Vibrations in Structures Induced by Man and Machines; Structural Engineering Document 3e; International Association for Bridge and Structural Engineering (IABSE): Zurich, Switzerland, 1987; Chapter 2: Man-Induced Vibrations, Appendix A: Case Reports. Fujino, Y.; Pacheco, B.M.; Nakamura, S.-I.; Warnitchai, P. Synchronization of Human Walking Observed during Lateral Vibration of a Congested Pedestrian Bridge. Earthq. Eng. Struct. Dyn. 1993, 22, 741–758. [CrossRef] Wernimont, E.; Ventura, M.; Garboden, G.; Mullens, P. Past and Present Uses of Rocket Grade Hydrogen Peroxide; General Kinetics, LLC: Aliso Viejo, CA, USA, 2018; p. 92656. Duddu, P. The World’s Deadliest Torpedoes. Naval Technology. 8 June 2014. Available online: https://www. naval-technology.com/features/featurethe-worlds-deadliest-torpedoes-4286162/ (accessed on 7 May 2018). Guardian. What Really Happened to Russia’s ‘Unsinkable’ Sub. The Guardian, 4 August 2001. Faulconbridge, G. Nightmare at Sea. Moscow Times, 3 December 2004; Archived from the original on 28 February 2014. Garfield, L. The ‘Death Ray Hotel’ Burning Las Vegas Visitors Came Up with a Simple Fix. Business Insider. 30 June 2016. Available online: http://www.businessinsider.com/the-vdara-death-ray-hotel-is-stillburning-people-in-las-vegas-2016-6 (accessed on 7 May 2018). Maimon, A. Vdara Visitor: ‘Death Ray’ Scorched Hair. Las Vegas Review-Journal. 24 September 2010. Available online: https://www.reviewjournal.com/news/vdara-visitor-death-ray-scorched-hair/ (accessed on 7 May 2018). Hodge, D. Reflective “Death Ray” Torments Vegas Sunbathers. Reuters Environment. 1 October 2010. Available online: https://www.reuters.com/article/us-lasvegas-deathray-idUSTRE6904AR20101001 (accessed on 7 May 2018). Smith-Spark, L. Reflected Light from London Skyscraper Melts Car. CNN. 3 September 2013. Available online: http://edition.cnn.com/2013/09/03/world/europe/uk-london-building-melts-car/index.html (accessed on 7 May 2013). BBC. Who, What, Why: How Does a Skyscraper Melt a Car? 3 September 2013. Available online: http: //www.bbc.com/news/magazine-23944679 (accessed on 7 May 2018). YouTube. Man Fries Egg in London Skyscraper Heat. TheNetFrancesco. 3 September 2013. Available online: https://www.youtube.com/watch?v=TGnZz8-PvdY (accessed on 7 May 2018). Sherwin, A. Walkie Talkie City Skyscraper Renamed Walkie Scorchie after Beam of Light Melts Jaguar Car Parked Beneath It. The Independent. 3 September 2013. Available online: https://www.independent.co.uk/artsentertainment/architecture/walkie-talkie-city-skyscraper-renamed-walkie-scorchie-after-beam-of-lightmelts-jaguar-car-parked-8794970.html (accessed on 7 May 2018). Washington Post News Service. London’s ‘Fryscraper’ Draws Crowd on Hottest Day. Mississauaga News. 6 September 2013. Available online: https://www.mississauga.com/news-story/4067822-london-sfryscaper-draws-crowd-on-hottest-day/ (accessed on 7 May 2018). Rhee, J.; Ross, B.; Ferran, L.; Hosford, M. Toyota Recalls 2.17 Million Vehicles Over Pedal Entrapment. ABC News. 24 February 2011. Available online: https://abcnews.go.com/Blotter/toyota-recalls-21-millionvehicles-floor-mats-pedals/story?id=12989254 (accessed on 7 May 2018). Evans, S.; MacKenzie, A. The Toyota Recall Crisis: A Chronology of How the World’s Largest and Most Profitable Automaker Drove into a PR Disaster. Motor Trend. 27 January 2010. Available online: http: //www.motortrend.com/news/toyota-recall-crisis/ (accessed on 7 May 2018). Cramer, M. 11 Terrible Automotive Engineering Decisions. 2010. Available online: https://jalopnik.com/ 5570865/11-terrible-automotive-engineering-decisions/ (accessed on 17 August 2018).

Systems 2018, 6, 34

35. 36. 37. 38. 39. 40.

41. 42. 43.

44.

45.

46.

47.

20 of 20

Feldt, A.G. Chapter 2: General Systems Theory. 1986. Available online: http://www.holisticwisdom.org/ hwpages/chapt%202%20-%20GST.htm (accessed on 18 June 2018). Jon. R.I.P Microsoft Zune (2006–2011). Methodshop. 2011. Available online: https://www.methodshop.com/ 2011/03/microsoft-zune-rip.shtml (accessed on 13 August 2018). Norman, D. Designing for People—Systems Thinking: A Product is more than the Product. Interactions 2009, 16, 52. [CrossRef] Johns Hopkins Whiting School of Engineering. System Context Diagrams. 1 February 2014. Available online: https://ep.jhu.edu/about-us/news-and-media/systems-context-diagrams (accessed on 8 June 2018). Monat, J.P.; Gannon, T.F. Using Systems Thinking to Solve Real-World Problems; College Publications: London, UK, 2017. The Systems Thinker. Guidelines for Drawing Causal Loop Diagrams; Pegasus Communications: Waltham, MA, USA, February 2011; Volume 22, No. 1; Available online: https://thesystemsthinker.com/wp-content/ uploads/pdfs/220109pk.pdf (accessed on 11 June 2018). Kim, D.H. Introduction to Systems Thinking; Pegasus Communications: Waltham, MA, USA, 1999; pp. 5–10. Federal Aviation Administration. System Engineering Functional N2 Diagram; Federal Aviation Administration: Washington, DC, USA, 2006. Bechtel Jacobs Company. UF6 Cylinder Project Systems Engineering Management Plan. U.S. Dept. of Energy. July 1998. Available online: http://www.oakridge.doe.gov/duf6disposition/KTSO-017.pdf (accessed on 11 June 2018). U.S. Department of Defense, Chief Information Officer. DoDAF Viewpoints and Models, Systems Viewpoint, SV-3: Systems-Systems Matrix. Available online: https://dodcio.defense.gov/Library/DoD-ArchitectureFramework/dodaf20_sv3/ (accessed on 11 June 2018). Wagenhals, L.; Levis, A. C4ISR Architectures and their Implementation Challenges, Lecture 4: A C4ISR Architecture Framework Implementation Process Case Study. INCOSE. Available online: http://slideplayer. com/slide/701808/ (accessed on 11 June 2018). Hyatt, K. Roadshow’s guide to car subscriptions, an alternative to buying or leasing. 14 June 2018. Available online: https://www.cnet.com/roadshow/news/new-car-subscription-service-guide-buyingleasing-2018/ (accessed on 27 June 2018). Blanchard, B.; Fabrycky, W. Systems Engineering and Analysis, 5th ed.; Prentice Hall: Upper Saddle River, NJ, USA, 2011. © 2018 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (http://creativecommons.org/licenses/by/4.0/).